dfa783e0d4748b8bd3e0c390af565fb2aaabf81dcba9b23352b6e92a773e1ed8

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260720-vlsafsax51
SHA256 dfa783e0d4748b8bd3e0c390af565fb2aaabf81dcba9b23352b6e92a773e1ed8
MD5 bb0f18b9b36fb40396e4414526c30c33
SHA1 a7557e210f643e656db6f04a7a17146f6a400d2c
SHA512 79efb43710b88c78071f174ebdc8296f2fd963ae808bd79d198b7e5f188bf804a16b92fcc627dc8ad34cd666a7401cec45d129a63d432a126e341a2a912ca22b
SSDEEP 3072:vbuMGq4hOSOVgjsv7r3wqLMn+CW6fZEJH0IDHM1Jcc:TGq4sHVg83wmMnU6fsHF7m
TLSH
T134E3D0357AA08535E06366705CB0D5B2A62B756103B845CBBBDC1BBFAF706C15E3832B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4640	PUkMu.exe
5668	2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
2404	2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5668 set thread context of 2404	5668	2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PUkMu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 4640	3316	2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 4640 wrote to memory of 5668	4640	PUkMu.exe	90
PID 5668 wrote to memory of 2404	5668	2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 5668 wrote to memory of 2404	5668	2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 5668 wrote to memory of 2404	5668	2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 5668 wrote to memory of 2404	5668	2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 5668 wrote to memory of 2404	5668	2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Users\Admin\AppData\Local\Temp\PUkMu.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" sj8iI9UU
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Users\Admin\AppData\Local\Temp\2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\PUkMu.exe" jOb4MCmp
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-20_bb0f18b9b36fb40396e4414526c30c33_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      3dyL38tr
      4⤵
      Executes dropped EXE
      PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PUkMu.exe

Path C:\Users\Admin\AppData\Local\Temp\PUkMu.exe
Size 149KB
SHA256 f687a34df5cec922aa2c441bbc2a9b470df7deeac4b923f73eb4abd55e28d8f1
MD5 e5f5da526add7418e26b86a64859340a
SHA1 397d4ca5d2d11bf8cfc26b38dd3eaa0ce5ef7b0c
SHA512 a8853e49229e19d4e8bf97c540aa7f56b3ee7923ee89be59d89591490f2483a58a997f5b22a3c01c5acd73d67defac74e7cf2ce7bf939d3d820f45e7d48461b2
SSDEEP 3072:vbuMGq4hOSOVqjsv6SyONnQfY7DNXhUo3oII2imQhT0S:TGq4sHVWtS35nDXTfDi9hYS
TLSH
T18CE3D0257EA08431E15322305D75D6B7A62BB46117B842CB77992FBDAF706C08E3C36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2404-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download